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IN THE UNITED STATES PATENT AND TRADEMARK OFFICE 



In re Application of: 
Serial No.: 
Filing Date: 
Group Art Unit: 
Examiner: 
Confirmation No. 
Title: 



Paul Gassoway 
10/849,318 
May 19, 2004 
2136 

Oscar A. Louie 
5789 

Method and Systems for Computer Security 



Mail Stop AF 

Commissioner for Patents 

P.O. Box 1450 

Alexandria, VA 22313-1450 

Dear Sir: 



PRE-APPEAL BRIEF REQUEST FOR REVIEW 

The following Pre-Appeal Brief Request for Review ("Request") is being filed in 
accordance with the provisions set forth in the Official Gazette Notice of July 12 5 2005 ("OG 
Notice"). Pursuant to the OG Notice, this Request is being filed concurrently with a Notice 
of Appeal. Applicant respectfully requests reconsideration of the application in light of the 
remarks set forth below. 
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REMARKS 

Applicant received a Final Office Action dated May 26, 2010 ("Office Action") to 
which Applicant responded with a response dated July 26, 2010 ("Previous Response"), after 
which, Applicant received an Advisory Action dated August 9, 2010 ("Advisory Action"). 
At the time of the Advisory Action, Claims 1-24 were pending, of which, Claims 1-24 were 
rejected. Applicant seeks review of the rejections of Claims 1-24. 

Rejections under 35 U.S.C. § 103 

L Claims 1-4, 7-10, 13-16, and 19-22 

The Examiner rejects Claims 1-4, 7-10, 13-16, and 19-22 under 35 U.S.C. § 103(a) as 
being unpatentable over U.S. Patent No. 6,279,113 issued to Vaidya ("Vaidya") in view of 
U.S. Publication No. 20050037733 issued to Coleman et al. ("Coleman"). Applicant 
respectfully traverses these rejections for at least the reasons discussed below. 

In order to establish a prima facie case of obviousness of a claimed invention, all 
claim limitations must be taught or suggested by the prior art. See M.P.E.P. § 2143. 

Claim 1 recites, in part: 

comparing the received data with the database of signatures; 

increasing the system certainty value if the received data does not 
match a signature in the database; 

decreasing the system certainty value if the received data matches a 
signature in the database; and 

filtering the data based on the system certainty value and the signature 
certainty value of a signature matching the received data. 

Applicant respectfully contends that the proposed Vaidya-Coleman combination fails 
to disclose, teach, or suggest every limitation of Claim 1. The Office Action relies on 
Coleman to disclose the limitations "determining an initial system certainty value for the 
computer system," "increasing the system certainty value if the received data does not match 
a signature in the database," and "decreasing the system certainty value if the received data 
matches a signature in the database." Office Action, pgs. 5-8. 

In rejecting these claims, the Office Action relies on the "mistrust level for each 
wireless network device" as reciting an initial system certainty value for the computer 
system. Office Action, pg. 5. Applicant respectfully disagrees. These mistrust levels 
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correspond to individual levels associated with each wireless network device located within a 
computer system. There is no disclosure, teaching, or suggestion of a single initial system 
certainty value for the computer system . 

Furthermore, even if the Office Action's proposed mapping is correct (a point 
Applicant does not concede), Applicant respectfully contends that Coleman fails to disclose, 
teach, or suggest the "increasing" and "decreasing" claim limitations. For instance, Coleman 
clearly states that "mistrust level decrementing is accomplished based on three parameters, 
described as follows: (1) a decrement timer Dl exceeds a mistrust level decrement interval 
from the operational protection suite; (2) mistrust level four has been reached, the wireless 
network device 36, 38 successfully re-authenticates, and re-login is also successful; (3) 
manual intervention 90 from the network administrator 92." Coleman, f 0121. Therefore, 
Coleman discloses a decrementing step based only on timing, manual intervention, or re- 
authentication. There is no disclosure, teaching, or suggestion that matching or not matching 
a signature plays any role in this step. 

In response to these arguments, the Office Action states "'matching signatures' 
specifically the 'signatures' can be any criteria that are deemed as an intrusion that is then 
matched or determined to be a known intrusion." Office Action, pg. 13. The Advisory 
Action further states that decrementing could be based on "any event that would trigger a 
responsive action." Advisory Action, pg. 2. Despite these unsupported assertions, Applicants 
respectfully maintains that Coleman discloses "decrementing" based only on the three criteria 
listed above. This fails to disclose a decrementing step based on "any criteria that are 
deemed as an intrusion that is then matched." Therefore, even under the Office Action's 
proposed "broadest" interpretation, this cited portion fails to disclose, teach, or suggest 
"decreasing the system certainty value if the received data matches a signature in the 
database." Accordingly, Applicant respectfully requests reconsideration and allowance of 
independent Claim 1, along with its dependent claims. For substantially similar reasons, 
Applicant respectfully requests reconsideration and allowance of independent Claims 7, 13, 
and 19, along with their respective dependent claims. 

Additionally, Claim 3, which depends from independent Claim 1, discloses that the 
increased or decreased certainty value becomes the initial system value. First of all, as 
discussed above, Coleman fails to disclose, teach, or suggest a "system certainty value." 
Furthermore, the cited portion of Coleman merely discloses that the mistrust level for 
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individual network devices is "initialized to zero, then incremented and/or decremented." 
Coleman, \ 0102. However, there is no disclosure, teaching, or suggestion that the 
incremented or decremented device mistrust level "becomes the initial system value." 
Vaidya fails to cure this deficiency. Accordingly, Applicant respectfully contends that Claim 
3 is patentably distinguishable from the references cited by the Examiner. Claims 9, 15, and 
21 are patentably distinguishable for analogous reasons. 



ii. Claims 5-6, 11-12, 17-18, and 23-24 

The Examiner also rejects Claims 5, 1 1, 17, and 23 under 35 U.S.C. § 103(a) as being 
unpatentable over Vaidya in view of Coleman, in view of U.S. Publication No. 20040172557 
issued to Nakae et al. ("Nakae"); and Claims 6, 12, 18, and 24 under 35 U.S.C. § 103(a) as 
being unpatentable over Vaidya in view of Coleman, in view of Nakae, and in view of U.S. 
Patent No. 7,032,114 issued to Moran ("Moran"). Applicant respectfully traverses these 
rejections for at least the reasons discussed below. 

As shown above, Applicant respectfully contends that the proposed Vaidya-Coleman 
combination fails to disclose, teach, or suggest every limitation of the independent base 
claims. The additional cited references fail to cure these deficiencies. As such, Applicant 
respectfully contends that Claims 5-6, 11-12, 17-18, and 23-24 are allowable over the cited 
references. Accordingly, Applicant requests reconsideration and allowance of Claims 5-6, 
11-12, 17-18, and 23-24. 

Additionally, Claim 6, which depends from Claim 1, discloses that the step of 
forwarding further comprises generating a message log to indicate that data matching a 
signature was forwarded. The Examiner admits that Vaidya, Coleman, and Nakae fail to 
disclose this limitation and relies instead on Moran. However, the cited portion discloses "a 
mechanism for checking timestamps, configured to identify backward and forward time steps 
in a log file." Moran, col. 4, lines 28-31. While this discloses identifying time steps in a log 
file, Moran fails to disclose, teach, or suggest actually generating a log file, much less a log 
file that indicates that data matching a signature was forwarded . Accordingly, Applicant 
respectfully contends that Claim 6 is patentably distinguishable from the cited references. 
Claims 12, 18, and 24 are patentably distinguishable for analogous reasons. 
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Conclusion 



As the rejections of Claims 1-24 contain clear legal and factual deficiencies, 
Applicant respectfully requests a finding of allowance of Claims 1-24. If the PTO determines 
that an interview is appropriate, Applicant would appreciate the opportunity to participate in 
such an interview. To the extent necessary, the Commissioner is hereby authorized to charge 
any required fees or credit any overpayments to Deposit Account No. 02-0384 of Baker 
Botts L.L.P. 



Respectfully submitted, 
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